HyENA has announced plans to close every market between Aug. 31 and Sept. 2 after processing more than $4 billion in trades for over 12,000 users.

HyENA will remove markets over three days

HyENA said in an Aug. 28 shutdown announcement that it would stop operating after changes in Hyperliquid’s stablecoin setup reduced the opportunity for USDe-backed margin products.

The platform will begin delisting markets on Aug. 31 and complete the process on Sept. 2. Rather than closing every contract at once, HyENA will remove one market per hour throughout the scheduled period.

Users do not have to close their positions manually before each delisting, according to the announcement. Once a market is removed, its mark price will move toward the one-hour weighted average of the relevant oracle price before the remaining positions settle automatically.

Margin released through that process will return to each trader’s spot balance. HyENA said user funds are not at risk during the closure, although traders may still choose to exit positions before their respective markets reach the settlement stage.

“User funds are safe,” the team said, adding that the planned process is designed to let customers withdraw their assets without requiring manual settlement.

HyENA has handled more than $4 billion in cumulative trading volume since launch, according to the team. Over 12,000 traders used the platform, while holders of USDe margin received almost 2.5 million USDe in rewards.

Built by the Based team, HyENA used Hyperliquid’s HIP-3 system to offer perpetual contracts with Ethena’s USDe serving as margin. The design allowed traders to keep margin in USDe and receive rewards while using the same capital to support open derivatives positions.

Hyperliquid’s USDC alignment reduced room for USDe

At launch, HyENA operated during a period when several dollar-linked assets were competing for a larger role within Hyperliquid. The team identified USDT, USDe, and USDH among the assets seeking use across the trading network.

Hyperliquid’s closer relationship with USDC later changed the conditions supporting HyENA’s model, the announcement said. While the team described stronger USDC integration as a reasonable course for Hyperliquid, it also said the arrangement left less room to expand USDe-based margin.

In May, Coinbase became Hyperliquid’s official USDC treasury deployer under an agreement that also made USDC an aligned quote asset across the ecosystem. As crypto.news previously reported, Hyperliquid held about $5 billion in circulating USDC at the time, roughly twice the amount recorded a year earlier.

USDC gained another defined role under the agreement, with Circle supplying cross-chain infrastructure through its Cross-Chain Transfer Protocol and Coinbase handling treasury deployment. The arrangement also gave Coinbase purchasing rights for USDH-branded assets through Native Markets.

By June 11, USDC had become Hyperliquid’s preferred stablecoin, according to a July JPMorgan research note. The bank estimated that Hyperliquid held about $6 billion in USDC, equal to roughly 8% of the stablecoin’s circulating supply.

JPMorgan also said Coinbase would return 90% of the reserve income earned from USDC held on Hyperliquid to the protocol. The bank cut earnings estimates for Coinbase and Circle after assessing how the revenue-sharing terms could affect the two companies’ stablecoin income.

The agreement provides a direct U.S. connection because Coinbase and Circle are publicly traded American companies. JPMorgan’s assessment tied Hyperliquid’s stablecoin setup to the earnings outlook for both firms, although the bank still expected USDC-related income to grow through 2027 based on its interest-rate forecast.

HIP-3 leaves settlement duties with market deployers

HyENA’s closure also shows how HIP-3 market operators can manage contracts built on Hyperliquid without the core protocol directly running each product.

Under HIP-3, independent teams may introduce perpetual markets while using Hyperliquid’s order books, margin tools and liquidation system. Deployers choose the contract, oracle, leverage limits, and settlement terms, giving each operator responsibility for managing its markets.

A May report on HIP-3 noted that the framework went live in October 2025 and requires teams to stake HYPE before creating perpetual contracts. Products launched under the framework have included synthetic markets tied to commodities, listed shares, and private companies.

More recent coverage of a sharp move in an SK Hynix-linked perpetual explained that a HIP-3 deployer supplies oracle prices, external perpetual prices, and as many as two additional mark-price inputs. Hyperliquid then combines the submitted figures with local trading data to calculate the contract’s mark price.

The same HIP-3 market controls allow deployers to halt trading, adjust open-interest limits or settle contracts. HyENA is using that settlement authority to close its remaining markets according to the published schedule.

For its shutdown, HyENA said each final mark price would converge with the one-hour weighted average of the oracle price before settlement. The method matters for traders holding leveraged positions because the final mark price will determine the value at which outstanding contracts close.

HLPe withdrawals will continue through Upshift

Alongside the market closures, HyENA said users with HLPe deposits can claim their principal and accumulated rewards through Upshift. Deposits will be redeemable at a 1:1 rate, with no withdrawal charge from HyENA and a one-day redemption period.

The final regular reward distribution took place on Aug. 27, one day before the shutdown announcement. Affiliate rewards are scheduled for their last payment on Sept. 9, after the market-removal process has finished.

Ethena ended its exchange reward program in June 2026, according to HyENA. With that campaign already closed, the platform will leave HyENA Points in their final recorded state instead of taking another snapshot.

No point conversion or distribution will occur, and the points carry no monetary value, the announcement said. Addressing possible expectations of an eventual airdrop, the team also stated that HyENA has no token and no plans to issue one.

The fact that the people in the study were able to maintain lower levels of LDL and triglycerides for up to a year means that CRISPR was able to edit enough cells in the liver, where much of the body’s cholesterol and triglycerides are produced, to give patients the benefit of having lower levels of the lipids. It also shows that these edited cells continue to produce new generations of cells that carry the CRISPR edit in AGNPTL3. People who received the highest dose of the CRISPR therapy saw levels of the ANGPTL3 enzyme drop by nearly 80%, which contributed to a drop in LDL and triglycerides of about 50%. “This is a really big step for CRISPR to show the durability of the result,” says Dr. Luke Laffin, co-director of the Center for Blood Pressure Disorders at the Cleveland Clinic and lead author of the study.

The CRISPR therapy did not cause significant side effects—and researchers did not expect it to, since people born with the defective ANGPTL3 gene don’t seem to have serious diseases either. That means the one-time therapy could potentially replace the current treatment for high LDL and triglycerides: daily statin pills. While effective, many people don’t take the pills on a daily basis for years, which lowers their effectiveness. “We could look at a situation further down the line where we are able to give people a choice,” says Laffin. In the future, if someone has a serious family history of heart disease or high cholesterol, for example, “this therapy may be an option for them where we could treat them now, edit their [liver cells], and they can continue to have a genetic defect that we know is safe and will control their cholesterol.”

Solana validators have approved a major change to the network’s token supply schedule, voting to double the protocol’s annual disinflation rate. The decision is expected to slow future SOL issuance while preserving Solana’s long-term inflation endpoint.

Finalized results posted on Solana’s governance portal show the proposal—SGP-0002, also called “Double Disinflation”—received 67% support, with 25.16% voting against and 7.84% abstaining. Participation reached 60.7% of eligible stake, according to the finalized tally.

Key takeaways

• SGP-0002 passes with 67% support, despite notable opposition and a meaningful abstention share.
• Annual disinflation is set to rise from 15% to 30%, while the terminal inflation target remains at 1.5%.
• Solana is projected to reach 1.5% inflation faster—about 2.8 years instead of roughly 5.7 under the prior schedule.
• Lower issuance likely means less dilution for SOL holders, but staking rewards for delegators and validators may also decline.
• Large participants were split, with some major voting blocs shifting or diverging strongly from each other.

What the governance vote changes on Solana

SGP-0002 updates Solana’s disinflation mechanism by increasing the annual disinflation rate from 15% to 30%. Importantly, the proposal does not alter Solana’s long-term inflation target, which remains at 1.5%—meaning the network still aims to converge on the same terminal rate, just on a faster timeline.

According to Solana Compass, the revised schedule is expected to bring Solana to the 1.5% terminal inflation level in about 2.8 years, compared with an estimated roughly 5.7 years under the previous disinflation pace.

The same analysis estimated that the new policy would reduce issuance by about 18.9 million SOL over the next six years. That reduction is the core trade-off of “double disinflation”: potentially less token dilution over time, paired with reduced inflation-driven incentives that feed staking returns.

Numbers behind the approval: turnout and dissent

The finalized results reflect not only a clear majority in favor, but also substantial minority resistance. Per the governance tally, 25.16% of voting stake opposed the measure, while 7.84% abstained. Overall participation was 60.7% of eligible stake, a meaningful share that helped finalize the outcome.

The decision was part of Solana’s first binding governance process. Alongside SGP-0002, validators approved a proposed Solana Constitution and rejected a separate proposal related to resource and inclusion fees. The supply-rate vote therefore landed in the middle of a broader governance package rather than as a standalone change.

Big voters split—and one notable stance shifted

While the final result leaned toward approval, some of the largest governance participants were not aligned. Solana Compass noted that major participants were divided over SGP-0002. Figment—identified as the largest voter shown in the finalized governance data with 17.1 million SOL staked—voted entirely against the measure.

Other large participants reportedly took the opposite view. Helius and Jupiter, for example, backed the proposal overwhelmingly, according to the governance reporting referenced by Solana Compass.

Kraken’s voting behavior also drew attention. Solana Compass reported that Kraken’s position shifted during the vote. The US-based exchange initially voted against SGP-0002 at 12:33 UTC, which temporarily reduced support below the required threshold. By the end of voting, more than 90% of Kraken’s roughly 8.9 million SOL voting stake backed the proposal.

That kind of late re-alignment matters in binding governance systems, because threshold conditions can make outcomes sensitive to large holders’ final preferences.

Why the faster path to 1.5% matters for SOL holders

From an investor and network economics perspective, the key effect of doubling disinflation is the speed at which Solana’s inflation rate declines toward its terminal 1.5% target. A faster decline typically reduces the ongoing flow of new tokens into the market, which can lower dilution pressure for long-term SOL holders.

However, the vote also signals a change to the balance between supply control and staking incentives. Because disinflation determines the rate at which new SOL is reduced, moving to a higher disinflation schedule can correspond to lower inflation-driven rewards over time. That means delegators and validators may face a less generous reward environment relative to what the previous schedule implied.

In other words, SGP-0002 tightens the emissions profile while leaving the terminal destination unchanged—shifting the timing of rewards and token issuance rather than eliminating them outright.

Governance decision arrives alongside ETF momentum

Solana’s governance vote also landed amid continued interest in US-listed SOL exposure products, even with weaker performance for SOL earlier in the year.

According to an X post shared by Bloomberg ETF analyst Eric Balchunas, Bitwise’s Solana ETF surpassed $1 billion in assets, becoming the first Solana ETF to reach that milestone. Balchunas also said US Solana ETFs have accumulated roughly $1.7 billion in cumulative net inflows, with little sustained outflow since their launch, based on his Friday update.

While governance changes and ETF flows aren’t directly linked, the juxtaposition highlights a broader theme: Solana is simultaneously adjusting its long-term supply mechanics and drawing continued investor capital through regulated investment channels.

Next, SOL stakeholders should watch how quickly the new schedule translates into staking economics and whether major validators and large delegators adjust their strategies in response. On the market side, the key question is whether ETF-driven demand can counterbalance any reward-related expectations shifting due to lower future issuance.

A Bitcoin wallet linked to convicted Irish drug dealer Clifton Collins has transferred 500 BTC worth about $39.56 million to Coinbase Prime after the coins were reportedly inaccessible because their private keys had been lost.

Collins-linked Bitcoin has moved to Coinbase Prime

Lookonchain said in an Aug. 28 X post that Bitcoin connected to Collins was “moving again,” with 500 BTC reaching Coinbase Prime. The blockchain tracker valued the transaction at $39.56 million when it reported the transfer.

At the stated value, each Bitcoin was worth about $79,120. Lookonchain associated the transfer with a group of wallets that once held approximately 6,000 BTC and were thought to be inaccessible after their private keys disappeared.

The blockchain data identifies movements between labeled addresses, but Lookonchain did not provide evidence that Collins personally controlled the sending wallet or directed the transaction. Irish authorities had already gained access to several wallets in the same group, making it possible that the latest activity involved seized assets under official control.

Coinbase Prime serves institutions, companies, and government agencies through custody and trade execution services. Although Bitcoin sent to the platform could be sold, the deposit alone does not show whether the coins were liquidated, placed in custody, or moved as part of an asset-management process.

No statement from Ireland’s Criminal Assets Bureau, An Garda Síochána or Europol accompanied the latest transaction at the time of Lookonchain’s report. Without an official notice, the purpose of the transfer and the party that authorized it remain unconfirmed.

How authorities recovered the lost Bitcoin

Collins acquired about 6,000 BTC in late 2011 and early 2012 with proceeds from cannabis sales, according to earlier reports cited by Irish authorities and blockchain intelligence firms. Bitcoin traded at around $5 during parts of that period, putting his estimated purchase cost near $30,000 before the holdings later rose to hundreds of millions of dollars.

Rather than keeping the balance in one place, Collins reportedly divided the coins among 12 wallets containing roughly 500 BTC each. He printed the private keys on a sheet of paper and concealed it inside the aluminum cap of a fishing rod case stored at a rented property in County Galway.

Following his arrest in 2017, the property was cleared, and the fishing equipment was believed to have been taken to a waste facility. With the paper no longer available, the Bitcoin appeared unreachable even after the assets became subject to seizure proceedings.

Access began returning in March 2026, when Irish authorities announced that they had opened one of the wallets with help from Europol’s European Cybercrime Centre. As reported in March by crypto.news, the recovered wallet held 500 BTC and sent the coins to Coinbase Prime after years without activity.

Ireland’s Criminal Assets Bureau said Europol provided “highly complex technical expertise and decryption resources” for the operation. Neither agency disclosed the method used to open the wallet, leaving the technical details of the recovery outside the public record.

A second 500 BTC wallet became accessible by May, increasing the amount recovered from the Collins-linked group to 1,000 BTC. Earlier coverage of the seizure reported that the second batch followed a different route, reaching a Binance deposit address linked by Arkham Intelligence to market maker Wintermute rather than Coinbase Prime.

Previous recoveries reached 1,500 BTC

By early July, the Criminal Assets Bureau had secured another wallet with support from Europol, taking the known recovery to 1,500 BTC. A third 500 BTC recovery reduced the amount still associated with dormant addresses to about 4,500 BTC at the time.

The bureau said its July operation again involved the European Cybercrime Centre. Europol hosted operational meetings in The Hague and supplied technical and decryption support, according to the agency’s statement cited in the earlier report.

Lookonchain separately observed a 500 BTC deposit to Coinbase Prime around the same period, valuing that transaction at approximately $30.85 million. The Aug. 28 transfer carried the same number of coins but a higher dollar value because Bitcoin was trading at a higher price.

While the latest movement may represent access to another wallet, neither Lookonchain nor an Irish agency confirmed that authorities had completed a fourth 500 BTC recovery. Counting it as an additional seizure before an official statement would therefore go beyond the available evidence.

The original structure of 12 wallets, each holding about 500 BTC, explains why the observed transactions have repeatedly appeared in equal-sized batches. Public blockchain labels can connect addresses with known entities, though such labels do not always identify the person or agency controlling the private keys at the time of a transfer.

Coinbase Prime also handles U.S. seized assets

Coinbase Prime’s role gives the story a direct point of comparison for U.S. readers because American agencies also use the platform to manage forfeited cryptocurrency. The U.S. Marshals Service selected Coinbase Prime in 2024 to provide custody and trading services for certain seized digital assets.

In July 2026, wallets attributed to the U.S. government transferred nearly $297 million in Bitcoin and Ether to the platform. The transaction included about 3,940 BTC worth $244 million and approximately 30,000 ETH valued at $53 million, according to government wallet data.

Coinbase offers custody, financing, and execution through its institutional platform, so government deposits do not establish that a sale has occurred. U.S. agencies may transfer digital assets to consolidate holdings, satisfy a court order, return funds to verified victims, or prepare assets for disposal where legally permitted.

President Donald Trump’s March 2025 executive order created a Strategic Bitcoin Reserve for forfeited BTC held by the federal government. The order states that Bitcoin placed in the reserve should not be sold, while allowing agencies to follow court orders and meet restitution or law-enforcement obligations under existing law.

Ireland operates under its own asset-recovery system. The Criminal Assets Bureau pursues property considered to be proceeds of crime, while Europol can supply technical support to member states during investigations. Irish officials had not publicly identified the legal or operational purpose of the Aug. 28 Coinbase Prime transfer when Lookonchain flagged the transaction.

Bullish has provided USD.AI with a $100 million stablecoin debt facility to fund loans secured by graphics processing units used in artificial intelligence infrastructure.

Bullish said in a Friday announcement that the facility will give USD.AI capital to finance operators purchasing high-performance computing equipment, extending the exchange operator’s exposure to tokenized assets and AI infrastructure.

Developed by Permian Labs, USD.AI connects stablecoin liquidity with companies seeking funds to buy GPUs. Instead of evaluating claims against a borrower’s entire business, the platform issues non-recourse loans secured by the computing hardware purchased with the financing.

Bullish Head of Tokenization Thomas Cowan said the company used USD.AI’s onchain records when assessing the facility. Bullish had already invested in the platform before agreeing to provide the new debt financing.

“Our commitment to USD.AI reflects a conviction we’ve believed since our first investment in the protocol: that credible, well-structured real-world assets belong onchain.”

Bullish facility expands USD.AI’s GPU loan capacity

Under the arrangement, USD.AI will use the $100 million facility to originate loans for middle-market AI infrastructure operators. Ownership of the financed hardware provides the collateral, while the loan does not create a claim against the operator’s other corporate assets, according to the announcement.

Such a structure separates the loan from the borrower’s main balance sheet, but repayment still depends on the income and resale value generated by the underlying computing equipment. GPUs can lose value as newer models enter the market, making loan terms, collateral checks and repayment schedules important parts of the financing process.

USD.AI has already completed large transactions involving recent Nvidia hardware. In June, the protocol announced a $98.1 million loan backed by 2,304 Nvidia B300 GPUs, while investors fully funded another $34 million facility secured by 768 Nvidia B200 units.

Combined, the two disclosed loans involved 3,072 GPUs and more than $132 million in financing. The latest Bullish facility gives the protocol another source of stablecoin liquidity as it adds loans for operators building data centers and AI computing clusters.

Permian Labs CEO David Choi said demand for computing equipment has created a distinct lending category.

“Compute is becoming a credit market in its own right,” Choi said, adding that Bullish’s facility would allow USD.AI to finance more infrastructure and develop trading markets for compute-backed debt.

According to USD.AI, its financing is settled onchain and gives capital providers exposure to loans backed by income-producing computing equipment. The company describes the funding as non-dilutive because operators do not have to surrender an ownership stake when borrowing.

sUSDai listing will create a secondary trading market

Alongside the lending facility, Bullish plans to introduce sUSDai across several trading pairs on its institutional exchange. A dedicated market-making program will provide orders for the token once trading begins, according to the companies.

USD.AI uses sUSDai as its yield-bearing token, giving holders exposure to returns generated from the protocol’s credit operations. Listing the asset would allow holders to trade the position instead of relying only on the repayment period of the underlying loans.

Bullish expects the program to improve secondary liquidity and price discovery for GPU-backed debt. The companies did not disclose the planned trading pairs, launch date or market-making budget in Friday’s announcement.

At the same time, Bullish and USD.AI are expanding a research project focused on ways to finance capital spending in the AI sector. The work will combine Bullish’s experience operating institutional markets with USD.AI’s lending structure, according to the announcement.

Tokenized exposure to computing hardware has appeared elsewhere in the crypto market. In August 2025, Injective introduced an Nvidia GPU derivatives market that allowed traders to gain exposure to rental prices for Nvidia H100 processors.

Aethir and Injective also launched a tokenized GPU marketplace in December 2024, using blockchain-based products to provide access to computing capacity. Unlike those trading and rental products, USD.AI’s model centers on secured loans issued to infrastructure operators.

Bullish deepens an existing USD.AI relationship

The $100 million facility follows Bullish Capital’s $4 million investment in USD.AI in September 2025. Cowan said onchain transparency allowed Bullish to review the protocol using the institutional underwriting standards applied elsewhere across its business.

Bullish operates spot and derivatives markets for professional investors and supplies the liquidity supporting the new facility.

In Europe, Bullish operates under the European Union’s Markets in Crypto-Assets framework as an authorized crypto asset service provider offering spot trading and custody. Its U.S. presence expanded after the company obtained a New York BitLicense in September 2025, when crypto.news reported that Bullish shares gained nearly 6% following the approval.

The license allowed Bullish to serve eligible customers in New York and arrived about one month after its public listing. Regulatory approval in the state added to the company’s U.S. operations, although Friday’s announcement did not specify whether sUSDai would be offered to American customers or describe any access limits.

Bullish stock rebounds after steep post-IPO decline

For U.S. investors, the transaction adds AI infrastructure lending to the businesses tied to NYSE-listed Bullish shares under the ticker BLSH. Any financial effect will depend on the facility’s terms, loan performance, and contribution to Bullish’s results, none of which the companies disclosed.

Bullish completed its New York Stock Exchange debut in August 2025 after pricing shares at $37. The offering raised about $1.03 billion, while the stock opened at $90 during its first trading session.

Earlier coverage of the Bullish public offering reported that the company entered the market at a valuation of about $5.4 billion after pricing above its original range. BlackRock-managed funds and accounts linked to ARK Investment Management had indicated interest in purchasing up to $200 million of stock.

Despite its recent recovery, BLSH remains more than 60% below its $90 opening price, according to Yahoo Finance data. The shares traded around $33 on Friday after gaining approximately 45% during the preceding month.

Other U.S.-traded crypto companies also advanced over the same period. Bitcoin treasury company Strive gained about 88%, Bitcoin miner Canaan rose roughly 55%, and USDC issuer Circle added close to 40%.

North Korea-linked Lazarus Group has transferred 244.148 Bitcoin worth about $19.42 million, bringing fresh attention to wallets associated with one of the crypto industry’s most active hacking operations.

Lazarus Group moves 244 BTC between wallets

Lookonchain reported the transfer in an Aug. 28 X post, saying wallets attributed to Lazarus Group had become active again and moved 244.148 BTC about an hour before its alert.

Bitcoin traded at roughly $79,500 when the analytics account published its estimate, placing the transaction’s value at $19.42 million. Lookonchain did not identify the receiving address in the text of the post or say whether the Bitcoin moved to an exchange, mixer, or another wallet controlled by the group.

Without a disclosed destination, the transaction alone does not show that Lazarus sold or attempted to cash out the Bitcoin. Public blockchain records confirm when funds move between addresses, but connecting those addresses to an organization usually depends on labels and analysis supplied by investigators or blockchain intelligence firms.

The Aug. 28 transaction followed another large Bitcoin movement attributed to the group earlier in the month. On Aug. 12, Lookonchain said Lazarus transferred 262.2 BTC, then valued at approximately $16.64 million, from an identified wallet to a newly created address.

At the time, the analytics account described the transaction as a wallet-to-wallet transfer rather than a sale. Taken at their reported dollar values, the two August movements involved more than $36 million in Bitcoin, though no source has confirmed that the transactions came from the same balance or served the same purpose.

Past wallet activity shows why the destination matters. In March 2025, five unknown addresses received a combined 44.07 BTC worth about $3.76 million from wallets attributed to Lazarus, according to earlier on-chain reporting. The transactions reduced the tracked wallet’s holdings to 13,441 BTC at the time.

Bybit theft left Bitcoin across thousands of addresses

As crypto.news previously reported, Bybit sued North Korea and Lazarus Group in a Washington, D.C., federal court on Aug. 7, seeking to recover assets tied to the exchange’s $1.5 billion theft.

The lawsuit also named North Korea’s Reconnaissance General Bureau, or RGB, which the U.S. Treasury identifies as the country’s main intelligence agency. A federal judge issued a preliminary injunction that blocked unidentified defendants from transferring, selling, or disposing of certain assets connected to the case.

Bybit filed the civil action separately from ongoing U.S. criminal investigations. A preliminary injunction preserves the identified property while litigation continues and does not amount to a final decision on ownership or liability.

The FBI attributed the February 2025 Bybit attack to North Korean actors operating under the TraderTraitor name. According to the agency, the attackers converted part of the stolen holdings into Bitcoin and other assets before spreading them across thousands of addresses on several blockchains.

In its public alert, the FBI said it expected the assets to be moved again and eventually exchanged for government-issued currency. The bureau asked exchanges, bridges, decentralized finance services, blockchain analytics companies, and node operators to block transactions involving the addresses it identified.

By April 2025, Bybit CEO Ben Zhou said 27.6% of the stolen funds could no longer be tracked, according to an August report on North Korea’s attack methods. The same report said the distribution of assets across many Bitcoin wallets had made blockchain tracing more difficult.

Lookonchain has not connected the latest 244.148 BTC transfer directly to the Bybit theft. No government agency or blockchain intelligence company cited in the available reporting has publicly identified the source of the coins involved in the Aug. 28 movement.

Lazarus-linked attacks continued into 2026

Chainalysis estimated that North Korean hackers stole at least $2.02 billion in cryptocurrency during 2025, an increase of 51% from the previous year. The firm placed the country’s cumulative crypto theft at no less than $6.75 billion by the end of that period.

According to its December 2025 report, North Korean operations accounted for 76% of the value lost through attacks on crypto services during the year. Chainalysis said the attackers carried out fewer confirmed incidents but extracted larger amounts from successful breaches.

The firm also found that North Korean operators had increasingly targeted companies through impersonation and employee access. Some actors posed as job applicants to enter crypto businesses, while others pretended to recruit for known Web3 and artificial intelligence companies, according to Chainalysis.

Activity attributed to Lazarus continued in April 2026 when attackers drained approximately 116,500 rsETH, worth about $292 million, from KelpDAO’s LayerZero-based bridge. LayerZero attributed the attack with preliminary confidence to Lazarus Group’s TraderTraitor unit.

Chainalysis later said the attackers compromised infrastructure that supplied blockchain information to LayerZero’s verification system. By feeding false data to the system, they caused an Ethereum contract to release assets even though no matching token burn had occurred on the source network.

Rapid intervention blocked a second attempted theft worth about $95 million, according to Chainalysis. The Arbitrum Security Council also froze more than 30,000 ETH that investigators connected to the attacker’s downstream transactions.

By June, the KelpDAO attacker had moved approximately $220 million in unfrozen assets through privacy services, according to subsequent tracking data. The routes included THORChain, Wasabi, Tornado Cash, and Umbra, while around $1.7 million remained in the original wallets.

U.S. sanctions restrict dealings with Lazarus Group

The U.S. Treasury’s Office of Foreign Assets Control sanctioned Lazarus Group in September 2019 under an executive order targeting the North Korean government. OFAC identified Lazarus, Bluenoroff, and Andariel as state-controlled hacking groups connected to the RGB.

Under the designation, property belonging to Lazarus that enters the United States or comes under the possession or control of a U.S. person must be blocked and reported to OFAC. Treasury regulations also generally prohibit Americans from conducting transactions with sanctioned entities unless the agency authorizes them.

Treasury said Lazarus had targeted governments, financial institutions, media companies, manufacturers, infrastructure operators and cryptocurrency businesses through cyber theft, espionage and malware attacks. The department linked the group to the 2014 Sony Pictures breach and the WannaCry ransomware attack that affected computers across at least 150 countries.

U.S. authorities have also acted against services used to process funds tied to the group. In 2022, the Treasury sanctioned the virtual currency mixer Blender.io after saying it had handled more than $20.5 million from the roughly $620 million Ronin Network theft. The FBI later attributed the Ronin attack to Lazarus Group and APT38.

In August 2023, the FBI separately warned crypto companies about movements involving Bitcoin stolen by North Korean TraderTraitor actors. The agency said the group could attempt to cash out more than $40 million in Bitcoin and published six wallet addresses for private companies to examine.